444063 - Firefox crashes on [@ array_trace]

Status: RESOLVED DUPLICATE of bug 427718

(Core :: JavaScript Engine, defect)

Description

[Andrzej Margos]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a1pre) Gecko/2008070703 Minefield/3.1a1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a1pre) Gecko/2008070703 Minefield/3.1a1pre

FF crashes while using webmail service http://poczta.onet.pl  

Reproducible: Always

Steps to Reproduce:
1.Go to http://poczta.onet.pl/login.html
2.Log into service. 
Email: [e-mail] 
OnetHasło: poczta1
3.Change page to http://poczta.onet.pl/folder_d.html
4.Mark any message using checkbox
5.Delete message using [Usuń] 
6.Mark another message
7. Click [Przenieś]
8. Choose "SPAM"
9. OK
At step 6,9 or after going to error console and copying error message FF crashes with error:
AppName: firefox.exe	 AppVer: 1.9.1.3110	 ModName: js3250.dll
ModVer: 4.0.0.0	 Offset: 0003974c
Crash report is sent but I cannot find it on about:crashes


  



We had to force our users to use static version of webmail service instead of dynamic one. Problem has appeared in version 3.0 and is still present.

Comment 1

[Matthias Versen [:Matti]]

I can not reproduce the crash with FF3.0 on Vista.

Reporter:
Please do this :
Try to reproduce this crash in the Firefox safemode.
- http://kb.mozillazine.org/Safe_mode

If you still crash disable the flash plugin because it breaks the crash reporter.
Use Tools/Addons/Plugins for that.
If the crash reporter still fails then try this instructions to get a stack trace :
- http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

Comment 2

[Andrzej Margos]

Please pay attantion to step 3. 
Crash happens often when I switch to Error Console and try to copy error info.
I attach stacktrace generated from WindBbg.

Comment 3

[Andrzej Margos]

Attachment: Stacktrace

Comment 4

[timeless]

thanks, that was almost correct, except you didn't issue a command to get a stack trace, such as:

!analyze -v -f

Comment 5

[Andrzej Margos]

Here it is: ( from first exception)

FAULTING_IP: 
js3250!js_GetGCThingTraceKind+a
0045eb2a 8b41f1          mov     eax,dword ptr [ecx-0Fh]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0045eb2a (js3250!js_GetGCThingTraceKind+0x0000000a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000ff0
Attempt to read from address 00000ff0

FAULTING_THREAD:  00000250

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

PROCESS_NAME:  firefox.exe

MODULE_NAME: js3250

FAULTING_MODULE: 7c900000 ntdll

DEBUG_FLR_IMAGE_TIMESTAMP:  4871ee4c

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo

READ_ADDRESS:  00000ff0 

PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS

LAST_CONTROL_TRANSFER:  from 10059d18 to 0045eb2a

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0012baec 10059d18 00000070 0088a06c 0012bbbc js3250!js_GetGCThingTraceKind+0xa
0012bb54 10144f73 0087a000 00895950 00000002 xul!NS_CycleCollectorSuspect_P+0xafd8
0012bbbc 100cf882 00895950 00000000 0012bc88 xul!gfxWindowsFontGroup::MakeTextRun+0x4118
0012bbd0 00451185 00895950 00000002 00895950 xul!NS_InitXPCOM3_P+0x8e8
0012bbf4 10079f4e 0381c000 00000001 00000000 js3250!JS_strtod+0x1365
0012bc04 1007c422 0342dba0 00000000 1007c27c xul!NS_CycleCollectorSuspect_P+0x2b20e
00000000 00000000 00000000 00000000 00000000 xul!NS_CycleCollectorForget_P+0x1122


FOLLOWUP_IP: 
js3250!js_GetGCThingTraceKind+a
0045eb2a 8b41f1          mov     eax,dword ptr [ecx-0Fh]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  js3250!js_GetGCThingTraceKind+a

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  js3250.dll

STACK_COMMAND:  ~0s ; kb

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_c0000005_js3250.dll!base_address

Followup: MachineOwner
---------

Comment 6

[Andrzej Margos]

The same crash is on crash-stats:
http://crash-stats.mozilla.com/report/index/ae3f3733-4cf5-11dd-b8b3-001cc45a2ce4